Single-Database Private Information Retrieval

Transcription

1 MTAT Research Seminar in Cryptography Tartu University a g@ut.ee 1

2 Overview of the Lecture CMS - first single database private information retrieval scheme Gentry-Ramzan PBR Lipmaa Oblivious Transfer Protocol with Log-Squared Communication 2

3 PIR, PBR PIR - allows a user to retrieve the i th bit of an n-bit database, without revealing the value of index i to the database. PBR - natural and more practical extension of PIR in which, instead of retrieving only a single bit, the user retrieves a i th block with d bits in it. 3

4 CMS - first single-database PIR Proposed by Cachin, Micali and Stadler in 1999 Based on Φ - hiding assumption (that it is hard to distinguish which of two primes divide φ(m) for composite modulus m). Communication complexity is about O(log 8 n) per bit. 4

5 CMS - first single-database PIR, slide 2 Each index j [1, n] is mapped to a distinct prime p j. Query for bit b i : hard-to-factor modulus m so that p i φ(m) and a generator x Z m. Server response: r = x P mod m, where P = j p b j j Response retrieval: y : y p i r (mod m) b i = 1 5

6 Gentry-Ramzan private block retrieval scheme Published in 2005 Uses the fact that discrete logarithm computation is feasible in hidden subgroups of smooth order, while this task is still hard in general groups. (A number is called smooth if it has only small prime factors) 6

7 Gentry-Ramzan private block retrieval scheme, slide 2 The server partitions the n-bit database B into t blocks B = C 1 C 2... C t of size at most l bits. S = {p 1,..., p t } is a set of small distinct prime numbers. Each block C i is associated to a prime power π i (π i = p c i i, where c i is the smallest integer so that p c i i 2 l ) All parameters above are public. 7

8 Gentry-Ramzan private block retrieval scheme, slide 3 Server precomputes an integer e that satisfies e C i (mod π i ) using Chinese Remainder Theorem. To retrieve C i it suffices to retrieve e mod π i. 8

9 Gentry-Ramzan private block retrieval scheme, slide 4 To query for block C i, the user generates an appropriate cyclic group G = g with order G = qπ i for some suitable integer q and sends (G, g) to server, keeping q private. Example: an Z m group, where m is constructed to Φ - hide π i. m = Q 0 Q 1, where Q 0, Q 1 are safe primes: Q 0 = 2q 0 π i + 1, Q 1 = 2q 1 d + 1; q 0, q 1 are primes. Notice that G contains a subgroup H of smooth order π i, and that h = g q is a generator of H. 9

10 Gentry-Ramzan private block retrieval scheme, slide 5 Server responds with g e = g e G The user obtains e mod π i by setting h e = ge q H and performing a (tractable) discrete logarithm computation log h h e, which occurs entirely in the subgroup H of order p c i i and can be quite efficient if p i is small. To prove that log h h e = C i, let s rewrite e e πi (mod π i ) as e = e πi + π i E, for some E Z. Now: h e = g q e = g g /π i e = g e g /π i = g e π i g /π i g E g = g e π i g /π i = h e π i. 10

11 Gentry-Ramzan private block retrieval scheme, slide 6 Pohlig-Hellman algorithm let s write C i = log h h e in base p i (remember that C i is a number modulo p c i i ): C i = x 0 + x 1 p +... x c 1 p c 1, 0 x i < p 11

12 Gentry-Ramzan private block retrieval scheme, slide 7 Computational complexity Querier side: no more than 4 nl group operations. Server side: Θ(n) group operations. Communication complexity Suppose that the group G and any element of G can be described in l G bits. Then the total complexity is 3l G bits. 12

13 Lipmaa PIR protocol with log-squared communication first published in 2004 Takes advantage of the concept of length-flexible additively homomorphic (LFAH) public-key cryptosystems. Length-flexible public-key cryptosystem has an additional length parameter s Z +. The encryption algorithm maps sk-bit plaintexts, for any s and for security parameter k, to (s+ξ)k -bit ciphertexts for some small integer ξ q. 13

14 Lipmaa PIR protocol with log-squared communication Communication complexity Θ(k log 2 n + l log n) k = Ω(log 3 o(1) n); Computational complexity Sender s work is equivalent to Θ(nl) k 2+o(1) bit operations; Receiver s work is Θ((k log n + l) 2+o(1) ) 14

15 Lipmaa PIR protocol with log-squared communication Communication complexity The ratio of amount of bits transferred to the communication complexity is 1/(log n) to achieve a good rate in practice, n and l must be quite large (on the order of gigabits and megabits, respectively), before they begin to offset the large one-time cost represented by the k log 2 n term. Computational complexity Sender s work is equivalent to Θ(nl) k 2+o(1) bit operations; Receiver s work is Θ((k log n + l) 2+o(1) ) 15